ThreatExpert Report: Worm.Win32.Ngrbot.bzm, Win32.SuspectCrc, W32.IRCBot.NG!gen7, Generic..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 3 October 2012, 17:10:30
Processing time: 9 min 22 sec
Submitted sample:

File MD5: 0x3AF5FEEF5FBC65080520F07AD8E18140
File SHA-1: 0xE570F9D5B9A5A3F50C773510D941EA6CEB27E1A5
Filesize: 516,893 bytes
Alias:

Worm.Win32.Ngrbot.bzm [Kaspersky Lab]
Win32.SuspectCrc [Ikarus]

Summary of the findings:

What's been found	Severity Level
A network-aware worm that uses known exploit(s) in order to replicate across vulnerable networks.
MS04-011: LSASS Overflow exploit - replication across TCP 445 (common for Sasser, Bobax, Kibuv, Korgo, Gaobot, Spybot, Randex, other IRC Bots).
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Profiles%\svhost.exe %ProgramFiles%\Common Files\System\svhost.exe %Windir%\Temp\services.exe	122,368 bytes	MD5: 0x29574CC311169B17F9DE258B4DD6ADDB SHA-1: 0xD4B1B1E067EFA0EFA89968B95F8760221B0F3593	W32.IRCBot.NG!gen7 [Symantec] Worm.Win32.Ngrbot.bzm [Kaspersky Lab] Generic BackDoor.aew [McAfee] Mal/Inject-CEE [Sophos] Trojan:Win32/Injector.AB [Microsoft] Backdoor.Win32.Ruskill [Ikarus]
2	%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Native\STUBEXE\@SYSTEM@\cmd.exe	17,408 bytes	MD5: 0x3F8797809FE4B773FEEB5BF9034F0E91 SHA-1: 0x8F9732646DFB04B4BE2F69A22BA235D697E290B6	Generic BackDoor!blo [McAfee] Troj/Poison-BP [Sophos] Backdoor:Win32/Bisar!rts [Microsoft] Backdoor.Win32.Poison [Ikarus] Win-Trojan/Poison.17408.BF [AhnLab]
3	%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Native\STUBEXE\@SYSTEM@\reg.exe	17,408 bytes	MD5: 0xD8A9847268A69B6CDD6F53497AF7EE63 SHA-1: 0xCBEF5111DB018BD5C55596C522982832839E9B9D	Backdoor.Trojan [Symantec] Generic BackDoor!dwp [McAfee]
4	%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Virtual\STUBEXE\@SYSTEM@\r.exe	17,408 bytes	MD5: 0x8EA987BDAE720884FB79D8B487D6C068 SHA-1: 0xADC777D5D7420430AC9952A6BDF5379F2D667A10	(not available)
5	%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Virtual\XRegistry.bin	141 bytes	MD5: 0xDAD0F5E26C7A4C01BE0A6CE3E1619273 SHA-1: 0x6D0B9607A69B1E69E91A60A19080CFFB432ED56C	(not available)
6	[file and pathname of the sample #1]	516,893 bytes	MD5: 0x3AF5FEEF5FBC65080520F07AD8E18140 SHA-1: 0xE570F9D5B9A5A3F50C773510D941EA6CEB27E1A5	Worm.Win32.Ngrbot.bzm [Kaspersky Lab] Win32.SuspectCrc [Ikarus]

Notes:

%Profiles% is a variable that refers to the file system directory containing user profile folders. A typical path is C:\Documents and Settings.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

The following directories were created:

%AppData%\Xenocode
%AppData%\Xenocode\Sandbox
%AppData%\Xenocode\Sandbox\1.0.0.0
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Native
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Native\STUBEXE
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Native\STUBEXE\@SYSTEM@
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Virtual
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Virtual\STUBEXE
%AppData%\Xenocode\Sandbox\1.0.0.0\2012.09.29T13.48\Virtual\STUBEXE\@SYSTEM@

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
services.exe	%Windir%\temp\services.exe	102,400 bytes
svhost.exe	%ProgramFiles%\common files\system\svhost.exe	102,400 bytes
r.exe	%System%\r.exe	159,744 bytes
cmd.exe	%AppData%\xenocode\sandbox\1.0.0.0\2012.09.29t13.48\native\stubexe\@system@\cmd.exe	397,312 bytes
r.exe	%AppData%\xenocode\sandbox\1.0.0.0\2012.09.29t13.48\virtual\stubexe\@system@\r.exe	159,744 bytes
reg.exe	%AppData%\xenocode\sandbox\1.0.0.0\2012.09.29t13.48\native\stubexe\@system@\reg.exe	106,496 bytes

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_CURRENT_USER\Software\Xenocode
HKEY_CURRENT_USER\Software\Xenocode\SandboxCache
HKEY_CURRENT_USER\Software\Xenocode\SandboxCache\A9B3BE66

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Windows Update = "%ProgramFiles%\Common Files\System\svhost.exe"

so that svhost.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

msmmsgr = "%Windir%\TEMP\x\services.exe"
ctfmon = "%Windir%\TEMP\services.exe"

so that services.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex objects were created:

qqq
ragebot
_xvm_mtx_file_0xA9B3BE66
_xvm_mtx_reg_0xA9B3BE66
_xvm_mtx_other_0xA9B3BE66

The following port was open in the system:

Port	Protocol	Process
1038	TCP	services.exe (%Windir%\temp\services.exe)

The following Host Name was requested from a host database:

50.7.239.180

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
50.7.239.180	7777

Outbound traffic (potentially malicious)

Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.